FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3199 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP     server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g.,     `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle.
    The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command     rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top`     (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without     bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with     attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function     pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command -- full instruction     pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to     receive a patch. (CVE-2026-26955)

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE     planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) +     (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that     `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes     `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by     `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with     attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to     132,096 bytes past the temp buffer end, and on the brk heap (desktop <= 128x128), an adjacent     `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data --     control-flow-relevant corruption (function pointer overwritten) demonstrated under deterministic heap     layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability. (CVE-2026-26965)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8105-1 advisory.

    It was discovered that FreeRDP incorrectly handled certain RDP packets. A remote attacker could use this     issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-53fe996a57 advisory.

    Update to 3.23.0 to fix CVE-2026-26965, CVE-2026-26955, CVE-2026-26271, CVE-2026-25997, CVE-2026-25959,     CVE-2026-25955, CVE-2026-25954, CVE-2026-25953, CVE-2026-25952, CVE-2026-25942, CVE-2026-25941



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0140 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-26965:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE     planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) +     (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that     `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes     `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by     `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with     attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to     132,096 bytes past the temp buffer end, and  on the brk heap (desktop  128128), an adjacent     `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data     control-flowrelevant corruption (function pointer overwritten) demonstrated under deterministic heap     layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.

    CVE-2026-26955:
    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP     server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g.,     `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle.
    The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command     rectangle against the destination surface dimensions, allowing attacker-controlled `cmd->left`/`cmd->top`     (and subcodec rectangle offsets) to reach image copy routines that write into `surface->data` without     bounds enforcement. The OOB write corrupts an adjacent `gdiGfxSurface` struct's `codecs*` pointer with     attacker-controlled pixel data, and corruption of `codecs*` is sufficient to reach an indirect function     pointer call (`NSC_CONTEXT.decode` at `nsc.c:500`) on a subsequent codec command  full instruction     pointer (RIP) control demonstrated in exploitability harness. Users should upgrade to version 3.23.0 to     receive a patch.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a160e550ec advisory.

    Update to 3.23.0 to fix CVE-2026-26965, CVE-2026-26955, CVE-2026-26271, CVE-2026-25997, CVE-2026-25959,     CVE-2026-25955, CVE-2026-25954, CVE-2026-25953, CVE-2026-25952, CVE-2026-25942, CVE-2026-25941

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-be60dd75d9 advisory.

    Update to 3.23.0 to fix CVE-2026-26965, CVE-2026-26955, CVE-2026-26271, CVE-2026-25997, CVE-2026-25959,     CVE-2026-25955, CVE-2026-25954, CVE-2026-25953, CVE-2026-25952, CVE-2026-25942, CVE-2026-25941


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE     planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) +     (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that     `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes     `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by     `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with     attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to     132,096 bytes past the temp buffer end, and on the brk heap (desktop  128128), an adjacent `NSC_CONTEXT`     struct's `decode` function pointer is overwritten with attacker-controlled pixel data  control-     flowrelevant corruption (function pointer overwritten) demonstrated under deterministic heap layout     (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability. (CVE-2026-26965)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303099	Amazon Linux 2 : freerdp, --advisory ALAS2-2026-3199 (ALAS-2026-3199)	Nessus	Amazon Linux Local Security Checks	high
303026	Ubuntu 24.04 LTS / 25.10 : FreeRDP vulnerabilities (USN-8105-1)	Nessus	Ubuntu Local Security Checks	high
302248	Fedora 42 : freerdp (2026-53fe996a57)	Nessus	Fedora Local Security Checks	medium
302079	TencentOS Server 4: freerdp (TSSA-2026:0140)	Nessus	Tencent Local Security Checks	high
301321	Fedora 44 : freerdp (2026-a160e550ec)	Nessus	Fedora Local Security Checks	medium
300389	Fedora 43 : freerdp (2026-be60dd75d9)	Nessus	Fedora Local Security Checks	medium
299995	Linux Distros Unpatched Vulnerability : CVE-2026-26965	Nessus	Misc.	high

Detections

Analytics

CVE-2026-26965

high

Tenable Plugins

high

high

medium

high

medium

medium

high